Skip to content

fix(ci): use the canonical Scorecard wrapper instead of a local copy #703

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 1 commit into from
Jul 21, 2026
Merged

fix(ci): use the canonical Scorecard wrapper instead of a local copy #703

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 7 additions & 29 deletions .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,42 +1,20 @@
# SPDX-License-Identifier: MPL-2.0
#
# Standalone OpenSSF Scorecard. Previously a thin caller of
# `hyperpolymath/standards/.github/workflows/scorecard-reusable.yml`; that
# cross-repo dependency had a persistent startup_failure history (see the
# prior note in this file's git history). This self-contained version calls
# `ossf/scorecard-action` directly — mirroring the already-direct sibling
# `scorecard-enforcer.yml` — so there is no external-repo workflow dependency.
# `ossf/scorecard-action` / `github/codeql-action` stay SHA-pinned (third-party
# actions); they match the pins used in scorecard-enforcer.yml.
name: Scorecards supply-chain security

on:
branch_protection_rule:
schedule:
- cron: '23 4 * * 1'
push:
branches: [main]
permissions:
contents: read

permissions: read-all

Check warning on line 11 in .github/workflows/scorecard.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Replace "read-all" with specific permissions (e.g., "contents: read"). 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_affinescript&issues=AZ-GedFfXl-5fvOsoQGo&open=AZ-GedFfXl-5fvOsoQGo&pullRequest=703

jobs:
analysis:
name: Scorecard analysis
runs-on: ubuntu-latest
timeout-minutes: 10
uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
permissions:
contents: read
security-events: write
id-token: write
steps:
- name: Checkout code
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
persist-credentials: false
- name: Run analysis
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
with:
results_file: results.sarif
results_format: sarif
publish_results: true
- name: Upload SARIF to code-scanning
uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v3
with:
sarif_file: results.sarif
secrets: inherit

Check warning on line 20 in .github/workflows/scorecard.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Only pass required secrets to this workflow. 


See more on https://sonarcloud.io/project/issues?id=hyperpolymath_affinescript&issues=AZ-GedFfXl-5fvOsoQGn&open=AZ-GedFfXl-5fvOsoQGn&pullRequest=703

Check failure

Code scanning / Semgrep OSS

Semgrep Finding: yaml.github-actions.security.secrets-inherit.secrets-inherit Error

This workflow uses secrets: inherit to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the secrets: map, e.g. secrets: { MY_SECRET: ${ secrets.MY_SECRET } }.
Loading